Industry: IT & Telecommunications
Company: DirectDefense
Location: Englewood, Colorado, USA
Company size: 11-50 employees
Product: Invicti Enterprise
“Invicti scans consistently in a more streamlined manner and delivers actionable results every time. The absence of false positives during the scan indicates that Invicti has previously independently validated the vulnerability before including it in the report. This allows our experts to avoid wasting time investigating false positives.”
Jim Broome
DirectDefense President
Founded in 2011, DirectDefense provides cybersecurity services that are of exceptional quality and are considered the benchmark in their industry. Their primary strength lies in their extensive experience conducting security assessments for a wide range of networks, platforms, applications, and web applications. DirectDefense’s experienced consultants are focused on providing their clients with world-class security services. Whether in the aerospace, financial services, insurance, retail, hospitality, healthcare, education, gaming, technology, or energy and utilities industries, DirectDefense’s wealth of knowledge and experience helps clients achieve their testing goals and security strategies.
Fast and Accurate Automated Web Application Security Scanning
As part of their services, DirectDefense offers penetration testing for web applications. At a minimum, they analyze around 300 web applications per month, so speed and accuracy are key factors when it comes to web application security. If the tools they use are slow, they cannot keep up with demand, and if they report false positives, consultants will waste valuable time reviewing the scan results.
Automated Web Application Security Scanner Needed
DirectDefense has been using automated web application security scanners since the beginning. They have tried many of them, but since 2011 they have been using Invicti as their primary scanner and prefer to use it unless they need another solution based on their clients’ requirements.
When asked why they use Invicti’s web application security scanner, they answer:
“Invicti consistently performs scans in a more streamlined manner and delivers actionable results every time. Scanning without false positives shows that Invicti pre-verifies the vulnerabilities it finds before including them in the report. This eliminates the need for additional search by our consultants and allows us to focus on the real threats.
This allows our consultants to focus on improving the testing and checks of existing vulnerabilities and providing faster results to our clients.”
Benefits of Invicti Web Application Security Scanner
Speed, automation, and accuracy are some of the reasons why a security company like DirectDefense uses this automated web vulnerability scanner, and according to Broome, Invicti delivers:
- Speed: It is easy to set up and is one of the fastest scanners in terms of scan execution time.
- Automation: Invicti is easy to automate and can successfully scan hundreds of websites and web applications.
- Accuracy: Invicti delivers accurate results time and time again, and when it is not 100% sure, it communicates this.
This allows the tester or consultant to focus on which findings need to be tested and which already have evidence of vulnerability.
The need to detect all technical vulnerabilities in all types of frameworks
Accuracy and adaptability are as important as speed and automation when the client base consists of large banks and financial institutions, therefore DirectDefense has seen it all. As Broome says, “We have scanned anything!” It could be a web application built on .NET, PHP, Spring, Struts or Java, running on an Apache, Nginx or IIS server. DirectDefense has dealt with similar environments before and scanned them using Invicti.
“Invicti has consistently demonstrated the ability to detect and confirm SQL injections faster than any other scanner we’ve used before. Whether it’s a banking web application or a cloud-based CRM system, regular testing is critical, and Invicti ensures that it does this effectively.”
World-class support is another important requirement
It is important to use the right security tools when scanning web applications to ensure a vulnerability is not missed. An attacker only needs to exploit one problem to gain unauthorized access to a web application and the sensitive data it stores. Website security is a critical business and should not be handled alone. Therefore, world-class support is also another important requirement that security experts like DirectDefense have when choosing their tools.
Invicti support is known for its world-class support, and Mr. Broome confirms this.
“Yes, whether you have a complex issue or even one that is easy to resolve, the Invicti support team is always ready to help. Don’t be surprised if you get an email from Ferruh (the CEO) with recommendations and suggestions.”
He couldn’t have said it better. Invicti is committed to providing world-class support. Even their CEO, who is an experienced penetration tester himself, gets involved in support tickets when needed.
